File name:

BIN.exe

Full analysis: https://app.any.run/tasks/a028492c-7c0c-4b89-afff-f129ce6ebc61
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: October 24, 2020, 17:03:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
teamviewer
tvrat
rat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

68B0FF10343F5E356F4682DFA79F9424

SHA1:

99754504507E53F7197A086C6CE61B1111275815

SHA256:

6A0BA704A65336684450FEF2FCDB9954E263AEE7A38EEB2140D79EF43183734B

SSDEEP:

98304:+x9cHoVw7srhNupA9+qlpZGB8ZW82jIV0Blzm:iCHoVukoXqlSBsW82MSBQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • test.exe (PID: 1948)

    • TEAMVIEWER was detected

      • test.exe (PID: 1948)

    • Changes the login/logoff helper path in the registry

      • test.exe (PID: 1948)

    • Application was dropped or rewritten from another process

      • test.exe (PID: 1948)

    • Loads dropped or rewritten executable

      • test.exe (PID: 1948)

    • Actions looks like stealing of personal data

      • test.exe (PID: 1948)

    • Application was injected by another process

      • SearchIndexer.exe (PID: 332)
      • svchost.exe (PID: 1052)
      • svchost.exe (PID: 872)

    • UAC/LUA settings modification

      • DllHost.exe (PID: 1712)

    • Runs injected code in another process

      • sdclt.exe (PID: 3692)

    • Changes settings of System certificates

      • svchost.exe (PID: 1052)

  • SUSPICIOUS

    • Creates files in the user directory

      • BIN.exe (PID: 2664)
      • test.exe (PID: 1948)

    • Executable content was dropped or overwritten

      • BIN.exe (PID: 2664)

    • Executed via COM

      • DllHost.exe (PID: 2496)
      • DllHost.exe (PID: 2416)
      • DllHost.exe (PID: 1712)
      • vdsldr.exe (PID: 2788)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1856)
      • DllHost.exe (PID: 1104)

    • Reads Internet Cache Settings

      • test.exe (PID: 1948)

    • Low-level read access rights to disk partition

      • wbengine.exe (PID: 1164)
      • vds.exe (PID: 184)
      • sdclt.exe (PID: 3692)

    • Creates files in the Windows directory

      • sdclt.exe (PID: 3692)
      • svchost.exe (PID: 1052)

    • Executed as Windows Service

      • wbengine.exe (PID: 1164)
      • vds.exe (PID: 184)
      • vssvc.exe (PID: 3816)

    • Removes files from Windows directory

      • sdclt.exe (PID: 3692)
      • svchost.exe (PID: 1052)

    • Starts Internet Explorer

      • FlashPlayerApp.exe (PID: 1416)

    • Creates files in the program directory

      • svchost.exe (PID: 872)

    • Adds / modifies Windows certificates

      • svchost.exe (PID: 1052)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2004)

    • Manual execution by user

      • iexplore.exe (PID: 2924)
      • MSASCui.exe (PID: 3480)
      • UserAccountControlSettings.exe (PID: 3188)
      • sdclt.exe (PID: 3692)
      • UserAccountControlSettings.exe (PID: 2644)
      • RunDll32.exe (PID: 2860)
      • MSASCui.exe (PID: 2536)
      • rundll32.exe (PID: 3396)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 892)
      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 3460)
      • iexplore.exe (PID: 2004)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 892)
      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 3460)

    • Application launched itself

      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2004)

    • Reads internet explorer settings

      • iexplore.exe (PID: 892)
      • iexplore.exe (PID: 3460)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2004)

    • Creates files in the user directory

      • iexplore.exe (PID: 892)
      • iexplore.exe (PID: 3460)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1856)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2004)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3816)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:06:25 12:38:24+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 200704
InitializedDataSize: 114176
UninitializedDataSize: -
EntryPoint: 0x1ea80
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Jun-2020 10:38:24
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 25-Jun-2020 10:38:24
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00030F2A
0x00031000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.70442
.rdata
0x00032000
0x0000A5F2
0x0000A600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.2593
.data
0x0003D000
0x00023720
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.70568
.didat
0x00061000
0x00000188
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.29951
.rsrc
0x00062000
0x0000E020
0x0000E200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.80352
.reloc
0x00071000
0x00002264
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.55675

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.25329
1875
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
5.10026
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
3
5.25868
3752
Latin 1 / Western European
UNKNOWN
RT_ICON
4
5.02609
1128
Latin 1 / Western European
UNKNOWN
RT_ICON
5
5.18109
4264
Latin 1 / Western European
UNKNOWN
RT_ICON
6
5.04307
9640
Latin 1 / Western European
UNKNOWN
RT_ICON
7
3.66634
508
Latin 1 / Western European
UNKNOWN
RT_STRING
8
3.71728
582
Latin 1 / Western European
UNKNOWN
RT_STRING
9
3.73856
422
Latin 1 / Western European
UNKNOWN
RT_STRING
10
3.55807
220
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
31
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start inject inject inject bin.exe #TEAMVIEWER test.exe wscui.cpl no specs msascui.exe no specs iexplore.exe iexplore.exe useraccountcontrolsettings.exe no specs %systemroot%\System32\UserAccountControlSettings.dll no specs %systemroot%\System32\UserAccountControlSettings.dll no specs useraccountcontrolsettings.exe no specs useraccountcontrolsettings.exe sdclt.exe searchindexer.exe svchost.exe svchost.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs vssvc.exe no specs rundll32.exe msascui.exe no specs rundll32.exe no specs flashplayerapp.exe no specs consent.exe no specs iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs consent.exe no specs Virtual Factory for Windows Firewall Cpl no specs

Process information

PID
CMD
Path
Indicators
Parent process
184C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vds.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
332C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\System32\SearchIndexer.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
872C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
892"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1052C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1104C:\Windows\system32\DllHost.exe /Processid:{A4B07E49-6567-4FB8-8D39-01920E3B2357}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1164"C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbengine.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1416"C:\Windows\system32\FlashPlayerApp.exe" C:\Windows\system32\FlashPlayerApp.exe—rundll32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Flash Player Control Panel Applet
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\flashplayerapp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1608"C:\Windows\system32\UserAccountControlSettings.exe" /applySettingsC:\Windows\system32\UserAccountControlSettings.exe
DllHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
UserAccountControlSettings
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\useraccountcontrolsettings.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1712C:\Windows\system32\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 104
Read events
2 705
Write events
394
Delete events
5

Modification events

(PID) Process:(1052) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(2664) BIN.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2664) BIN.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1948) test.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:ParseAutoexec
Value:
1
(PID) Process:(1948) test.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\Users\admin\AppData\Roaming\test.exe"
(PID) Process:(1948) test.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1948) test.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1948) test.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(872) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1302019708-1500728564-335382590-1000
Operation:writeName:RefCount
Value:
3
(PID) Process:(872) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1302019708-1500728564-335382590-1000
Operation:writeName:RefCount
Value:
2
Executable files
13
Suspicious files
80
Text files
190
Unknown types
68

Dropped files

PID
Process
Filename
Type
872svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
2664BIN.exeC:\Users\admin\AppData\Roaming\TeamViewer_Resource_en.dllexecutable
MD5:1EAD0B5A632B2D60414B5A1DAA4905F3
SHA256:9B3BD32D1AA4BCEDA829F03AB6CD980538ED1C94E1F1700833E7C680016D748E
2664BIN.exeC:\Users\admin\AppData\Roaming\VPN\x64\run.exeexecutable
MD5:112B0C8B6B0C0A6C24F90081CC8A77D0
SHA256:F627380E9DE14AF3EB5331BB9A4D559B2C970ABACFF038EA464044CA1EF62163
2664BIN.exeC:\Users\admin\AppData\Roaming\tv_x64.dllexecutable
MD5:DCD8CDA46BB20FF09C8C8BE8BE2F3098
SHA256:A21DAFAB3D25F88D7001DE9437F0A01C72D66DB0C1A190DD5ACDB2CC38EA9513
2664BIN.exeC:\Users\admin\AppData\Roaming\tv_w32.exeexecutable
MD5:7D90BDF0F9C2D9224D8B4D5D2F195506
SHA256:C96ED3B60727973D746834EAEC3DF520447A039DC447F717F6CD32335E2DC1D0
2664BIN.exeC:\Users\admin\AppData\Roaming\VPN\x64\TeamViewerVPN.infbinary
MD5:447FC733747DB11CD4492AE01C5652FE
SHA256:A817B0E8A669D5ACAF2DDFBC95ACF2A1213B092B44DC896A0EE4A5301D06EBC3
2664BIN.exeC:\Users\admin\AppData\Roaming\VPN\x64\teamviewervpn.sysexecutable
MD5:F5520DBB47C60EE83024B38720ABDA24
SHA256:B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
2664BIN.exeC:\Users\admin\AppData\Roaming\vpn.exeexecutable
MD5:694F241B7BEAF7C8C7524FB80E442D41
SHA256:3A9283AB360DC54977102A2B6103C115B064DED8D5631E3FEAB3D5CE482A4550
2664BIN.exeC:\Users\admin\AppData\Roaming\tv_x64.exeexecutable
MD5:E0331B54A56E7AA48F97B4956BCEF769
SHA256:7A487C2CBA93E7D6963930C5734F14D6CF17E85FC2316D6AECCD617100A1FF9F
892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar90D7.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
141
DNS requests
39
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
892
iexplore.exe
GET
302
88.221.62.148:80
http://go.microsoft.com/fwlink/?LinkId=123694
unknown
—
—
whitelisted
2860
RunDll32.exe
GET
—
52.255.148.73:80
http://watson.microsoft.com/StageOne/Generic/PnPRequestAdditionalSoftware/x86/USB_VID_0627_PID_0001_REV_0000/6_1_1_0/0409/input_inf/_.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=DELL&SPN=DELL&BV=DELL&MID=3ADE2C42-4AB9-49B7-B142-BE9AEEA69063&Queue=1
US
—
—
whitelisted
—
—
GET
—
52.255.148.73:80
http://watson.microsoft.com/StageOne/Generic/PnPRequestAdditionalSoftware/x86/USB_VID_0627_PID_0001_REV_0000/6_1_1_0/0409/input_inf/_.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=DELL&SPN=DELL&BV=DELL&MID=3ADE2C42-4AB9-49B7-B142-BE9AEEA69063&Queue=1
US
—
—
whitelisted
892
iexplore.exe
GET
304
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
1.47 Kb
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3460
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAZ2JfwMCbGcYKxKdYCjCAA%3D
US
der
471 b
whitelisted
3460
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3460
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1948
test.exe
188.172.219.158:5938
ping3.teamviewer.com
ANEXIA Internetdienstleistungs GmbH
NL
suspicious
1948
test.exe
185.188.32.5:5938
master5.teamviewer.com
TeamViewer GmbH
DE
suspicious
892
iexplore.exe
23.210.249.93:443
www.microsoft.com
Akamai International B.V.
NL
whitelisted
892
iexplore.exe
2.16.186.27:443
statics-marketingsites-neu-ms-com.akamaized.net
Akamai International B.V.
—
whitelisted
892
iexplore.exe
13.107.246.10:443
wcpstatic.microsoft.com
Microsoft Corporation
US
whitelisted
892
iexplore.exe
40.77.226.250:443
web.vortex.data.microsoft.com
Microsoft Corporation
IE
whitelisted
892
iexplore.exe
2.17.185.83:443
compass-ssl.microsoft.com
Akamai Technologies, Inc.
—
unknown
892
iexplore.exe
40.90.23.206:443
login.live.com
Microsoft Corporation
US
unknown
2924
iexplore.exe
23.210.249.93:443
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2924
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
ping3.teamviewer.com
  • 188.172.219.158
  • 213.227.162.126
  • 188.172.198.158
  • 188.172.246.190
  • 213.227.168.190
shared
master5.teamviewer.com
  • 185.188.32.5
shared
go.microsoft.com
  • 88.221.62.148
whitelisted
support.microsoft.com
  • 23.210.248.208
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.microsoft.com
  • 23.210.249.93
whitelisted
statics-marketingsites-neu-ms-com.akamaized.net
  • 2.16.186.27
  • 2.16.186.41
whitelisted
wcpstatic.microsoft.com
  • 13.107.246.10
whitelisted
mem.gfx.ms
  • 104.108.66.121
whitelisted
img-prod-cms-rt-microsoft-com.akamaized.net
  • 2.16.186.40
  • 2.16.186.27
whitelisted

Threats

PID
Process
Class
Message
1948
test.exe
Potential Corporate Privacy Violation
REMOTE [PTsecurity] TeamViewer
2860
RunDll32.exe
Potential Corporate Privacy Violation
ET POLICY Application Crash Report Sent to Microsoft
2860
RunDll32.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
Potential Corporate Privacy Violation
ET POLICY Application Crash Report Sent to Microsoft
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BIN.exe